First Flight #1: PasswordStore

Summary

There is no way to change the s_owner, i.e. the owner of the contract.

Vulnerability Details

The privileged user s_owner is set during deployment to the deployment wallet. If by necessity or any other reasons, the deploying wallet account needs to be replaced, there is no way to continue to call the access-controled functions of the contract,

Impact

If the wallet that deployed the contract is compromised, there is no way to protect the contract from getting exploited and revealing the "secret" password.

Tools Used

none

Recommendations

Implement an access-controled setNewOwner function that only the current owner can call. It will take as parameter a new address (that cannot be the null address) and should emit an OwnershipTransfered event.